1. Field of the Invention
The present invention relates to software, network communications, and mobile devices. More specifically, it relates to creating a virtual private network (VPN) between an app on a mobile device and a VPN gateway.
2. Description of the Related Art
Most mobile devices run multiple apps, many of which are personal or non-work related apps. However, some may be work-related apps that use confidential data and have to connect to a corporate VPN. It is becoming increasingly common for a mobile device, such as a tablet or smartphone, that belongs to an individual and has personal and work apps, to have a single, system-wide VPN connection that serves the entire device. Therefore, all apps on the device can potentially use this VPN tunnel. If any of the apps on the device have malware or have malicious intent, those apps may obtain access and communicate over a corporate VPN, thereby enabling the app to search for sensitive data, install malware, delete or corrupt data, and otherwise do harm to the corporate network and possibly to the mobile device. An entire corporate VPN gateway, connecting hundreds of its employees' personal mobile devices, collectively running thousands of apps, may be in danger of being infected by malware from just one of those apps running on a single smartphone or tablet.
The attack surface created by a device-level VPN is unnecessarily high, and the risk be unacceptable to many organizations. As noted, industry standard practice with regard to VPNs is for a single VPN to serve an entire computing system (i.e., mobile device, laptop computer, and the like). This is desirable from an efficiency standpoint because the same VPN connection may be re-used by any app running on a device, assuming the VPN is turned on or enabled at the system level. However, when not all apps running on a computing system are trusted—as many are not—a “per-device” or system-level VPN creates significant risk. It allows anyone with access to the device and the ability to download an app to the device to also access the VPN. For example, an attacker with physical access to a device with an active VPN could attack the remote network (such as a corporate or government network) in a number of ways using malware in the app. Or an attacker who has planted malware on the device could make use of the VPN without downloading an app.
In light of these risks, it would be desirable to be able to implement a VPN for a single app which cannot be used by other apps, unless under specific, well-defined circumstances. Essentially, it would be desirable to have a “per-app VPN” capability on a device. For example, only a security wrapped application would be aware of a VPN tunnel and, generally, only that wrapped application or app could use it. This would limit the attack surface of the device and the VPN gateway to a single app, as opposed to the entire computing system.